CVE-2025-52938
BaseFortify
Publication date: 2025-06-23
Last updated on: 2025-06-23
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dail8859 | notepadnext | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds read in the NotepadNext application, specifically in the Lua parser component (lparser.c) within the singlevar() function. The issue arises because the function lacks a call to luaK_exp2anyregup, which is necessary when handling the special environment variable _ENV marked as constant. Without this call, the program may generate incorrect bytecode or perform a heap-based buffer over-read when compiling untrusted Lua code, potentially leading to unexpected behavior or crashes. [2]
How can this vulnerability impact me? :
The vulnerability can lead to a heap-based buffer over-read when NotepadNext compiles untrusted Lua code. This may cause the application to behave incorrectly, crash, or potentially expose sensitive memory contents. Since the issue involves incorrect code generation for a constant _ENV variable, it could also result in runtime errors or unstable behavior in scripts executed by NotepadNext. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update NotepadNext to a version later than v0.11 where the fix has been applied. The fix involves adding a call to luaK_exp2anyregup in the singlevar() function in lparser.c to properly handle the constant _ENV variable and prevent the heap-based buffer over-read. Applying the patch or updating to a version that includes this fix will mitigate the issue. [2]